nansen-cli 1.13.1 → 1.15.0

package/src/wallet.js

@@ -8,6 +8,7 @@ import fs from 'fs';
 import path from 'path';
 import * as readline from 'readline';
 import { base58 } from '@scure/base';
+import { storePassword, retrievePassword, deletePassword, deleteCredentialsFile } from './keychain.js';
 
 // ============= Constants =============
 
@@ -238,8 +239,8 @@ function getWalletFile(name) {
  * Verify the global password against stored hash.
  */
 export function verifyPassword(password, config) {
+  if (password == null) return false;
   if (!config.passwordHash) return true; // No password set yet
-  if (password === null || password === undefined) return false;
   const { salt, hash } = config.passwordHash;
   const derived = crypto.scryptSync(password, Buffer.from(salt, 'hex'), 32, {
     N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P, maxmem: 256 * 1024 * 1024,
@@ -265,7 +266,7 @@ async function promptPassword(question, deps = {}) {
   if (promptFn) {
     return promptFn(question, true);
   }
-  // Fallback to readline
+  // Fallback to readline (only available in --human mode)
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
   return new Promise((resolve) => {
     if (process.stdout.isTTY) {
@@ -298,6 +299,60 @@ async function promptPassword(question, deps = {}) {
   });
 }
 
+/**
+ * Resolve wallet password from all available sources (non-interactive).
+ * Order: NANSEN_WALLET_PASSWORD env var → OS keychain → .credentials file → null
+ * Emits a warning to stderr when using the insecure .credentials file.
+ * @returns {string|null}
+ */
+function resolveWalletPassword() {
+  const { password, source } = retrievePassword();
+  if (source === 'file') {
+    process.stderr.write(
+      '⚠️  Password loaded from ~/.nansen/wallets/.credentials (insecure — plaintext on disk).\n' +
+      '   For better security, migrate to OS keychain: nansen wallet secure\n' +
+      '   Or set NANSEN_WALLET_PASSWORD via a secrets manager.\n'
+    );
+  }
+  return password;
+}
+
+/**
+ * Resolve wallet password for a command. If --human flag is set and no
+ * password found, falls back to interactive prompt. Otherwise returns
+ * structured error info for agents.
+ *
+ * @param {object} config - wallet config (needs config.passwordHash)
+ * @param {object} flags - CLI flags
+ * @param {object} deps - { promptFn, log, exit }
+ * @returns {{ password: string|null, error: string|null }}
+ */
+async function resolvePasswordForCommand(config, flags, deps) {
+  if (!config.passwordHash) {
+    return { password: null, error: null };
+  }
+
+  const password = resolveWalletPassword();
+  if (password) return { password, error: null };
+
+  if (flags.human && (process.stdin.isTTY || deps.promptFn)) {
+    const prompted = await promptPassword('Enter wallet password: ', deps);
+    if (prompted) return { password: prompted, error: null };
+  }
+
+  return {
+    password: null,
+    error: JSON.stringify({
+      error: 'PASSWORD_REQUIRED',
+      message: 'Wallet is encrypted and no password was found.',
+      resolution: [
+        'Set NANSEN_WALLET_PASSWORD environment variable',
+        'Or re-run wallet create with the password (it will be persisted for future use)',
+      ],
+    }),
+  };
+}
+
 // ============= Public API =============
 
 /**
@@ -312,6 +367,7 @@ export function listWallets() {
     const data = JSON.parse(fs.readFileSync(path.join(getWalletsDir(), f), 'utf8'));
     return {
       name: data.name,
+      provider: data.provider || 'local',
       evm: data.evm?.address || null,
       solana: data.solana?.address || null,
       createdAt: data.createdAt,
@@ -342,10 +398,18 @@ export function createWallet(name, password) {
   } else {
     // Encrypted mode
     if (!config.passwordHash) {
-      // First encrypted wallet: reject if passwordless wallets exist
-      const existingWallets = fs.readdirSync(getWalletsDir())
-        .filter(f => f.endsWith('.json') && f !== 'config.json');
-      if (existingWallets.length > 0) {
+      // First encrypted wallet: reject if passwordless local wallets exist
+      // (non-local wallets like Privy don't contain private keys, so skip them)
+      const walletsDir = getWalletsDir();
+      const existingLocalWallets = fs.readdirSync(walletsDir)
+        .filter(f => f.endsWith('.json') && f !== 'config.json')
+        .filter(f => {
+          try {
+            const data = JSON.parse(fs.readFileSync(path.join(walletsDir, f), 'utf8'));
+            return !data.provider || data.provider === 'local';
+          } catch { return true; }
+        });
+      if (existingLocalWallets.length > 0) {
         throw new Error('Existing wallets are passwordless. Cannot mix encrypted and unencrypted wallets.');
       }
       config.passwordHash = hashPassword(password);
@@ -397,13 +461,21 @@ export function showWallet(name) {
 
   const data = JSON.parse(fs.readFileSync(walletFile, 'utf8'));
   const config = getWalletConfig();
+  const isPrivy = data.provider === 'privy';
 
   return {
     name: data.name,
+    provider: data.provider || 'local',
     evm: data.evm?.address || null,
     solana: data.solana?.address || null,
     createdAt: data.createdAt,
     isDefault: data.name === config.defaultWallet,
+    ...(isPrivy ? {
+      privyWalletIds: {
+        evm: data.evm?.privyWalletId,
+        solana: data.solana?.privyWalletId,
+      }
+    } : {}),
   };
 }
 
@@ -416,13 +488,16 @@ export function exportWallet(name, password) {
     throw new Error(`Wallet "${name}" not found`);
   }
 
+  const data = JSON.parse(fs.readFileSync(walletFile, 'utf8'));
+  if (data.provider && data.provider !== 'local') {
+    throw new Error(`${data.provider} wallets don't support key export. Keys are managed by the provider.`);
+  }
+
   const config = getWalletConfig();
   if (config.passwordHash && !verifyPassword(password, config)) {
     throw new Error('Incorrect password');
   }
 
-  const data = JSON.parse(fs.readFileSync(walletFile, 'utf8'));
-
   return {
     name: data.name,
     evm: {
@@ -455,41 +530,37 @@ export function setDefaultWallet(name) {
 /**
  * Delete a wallet.
  */
-export function deleteWallet(name, password) {
+export async function deleteWallet(name, password) {
   const walletFile = getWalletFile(name);
   if (!fs.existsSync(walletFile)) {
     throw new Error(`Wallet "${name}" not found`);
   }
 
+  const data = JSON.parse(fs.readFileSync(walletFile, 'utf8'));
   const config = getWalletConfig();
-  if (config.passwordHash && !verifyPassword(password, config)) {
-    throw new Error('Incorrect password');
+
+  if (data.provider && data.provider !== 'local') {
+    // Non-local wallets: just remove local reference, no password needed
+  } else {
+    if (config.passwordHash && !verifyPassword(password, config)) {
+      throw new Error('Incorrect password');
+    }
   }
 
   fs.unlinkSync(walletFile);
 
-  if (config.defaultWallet === name) {
-    // Pick another wallet as default, or null
-    const remaining = fs.readdirSync(getWalletsDir()).filter(f => f.endsWith('.json') && f !== 'config.json');
-    config.defaultWallet = remaining.length > 0 ? remaining[0].replace('.json', '') : null;
-    saveWalletConfig(config);
-  }
+  const remaining = fs.readdirSync(getWalletsDir()).filter(f => f.endsWith('.json') && f !== 'config.json');
 
-  return { deleted: name, newDefault: config.defaultWallet };
-}
-
-/**
- * Get the default wallet's address for a given chain type.
- */
-export function getDefaultAddress(chainType = 'evm') {
-  const config = getWalletConfig();
-  if (!config.defaultWallet) {
-    throw new Error('No default wallet set. Run: nansen wallet create');
+  if (remaining.length === 0) {
+    config.defaultWallet = null;
+    config.passwordHash = null;
+    deletePassword();
+  } else if (config.defaultWallet === name) {
+    config.defaultWallet = remaining[0].replace('.json', '');
   }
+  saveWalletConfig(config);
 
-  const wallet = showWallet(config.defaultWallet);
-  const field = chainType === 'solana' ? 'solana' : 'evm';
-  return wallet[field];
+  return { deleted: name, newDefault: config.defaultWallet };
 }
 
 // ============= CLI Command Builder =============
@@ -504,6 +575,27 @@ export function buildWalletCommands(deps = {}) {
     'wallet': async (args, apiInstance, flags, options) => {
       const subcommand = args[0] || 'help';
 
+      // Privy-specific: only 'create' and policy commands need --provider privy
+      if (options.provider === 'privy' || process.env.NANSEN_WALLET_PROVIDER === 'privy') {
+        if (subcommand === 'create') {
+          const { createPrivyWalletPair } = await import('./privy.js');
+          const name = options.name || args[1] || 'default';
+          try {
+            const result = await createPrivyWalletPair(name);
+            log(`\n✓ Privy wallet "${result.name}" created\n`);
+            log(`  EVM:    ${result.evm.address}`);
+            log(`  Solana: ${result.solana.address}`);
+            log('');
+            return;
+          } catch (err) {
+            log(`❌ ${err.message}`);
+            exit(1);
+            return;
+          }
+        }
+        // All other subcommands fall through to unified handlers below
+      }
+
       const handlers = {
         'create': async () => {
           const name = options.name || args[1] || 'default';
@@ -512,32 +604,74 @@ export function buildWalletCommands(deps = {}) {
           if (flags['unsafe-no-password']) {
             process.stderr.write('WARNING: --unsafe-no-password is set. Private keys will be stored UNENCRYPTED on disk.\nAnyone with access to this machine can steal your funds.\n');
             password = null;
-          } else if (!process.env.NANSEN_WALLET_PASSWORD && !process.stdin.isTTY && !deps.promptFn) {
-            log('❌ No password provided. Either:');
-            log('   set NANSEN_WALLET_PASSWORD, or');
-            log('   use --unsafe-no-password (WARNING: Private keys will be stored UNENCRYPTED on disk. Anyone with access to this machine can steal your funds.)');
-            exit(1);
-            return;
           } else {
-            password = process.env.NANSEN_WALLET_PASSWORD || await promptPassword('Enter wallet password: ', deps);
-            if (!password || password.length < 12) {
-              log('❌ Password must be at least 12 characters');
+            // Step 1: Check env var and keychain
+            password = resolveWalletPassword();
+
+            // Step 2: If --human flag, allow interactive prompt (requires TTY)
+            if (!password && flags.human && !process.stdin.isTTY && !deps.promptFn) {
+              log(JSON.stringify({
+                error: 'NOT_A_TTY',
+                message: '--human requires an interactive terminal. Set NANSEN_WALLET_PASSWORD env var instead.',
+              }));
               exit(1);
               return;
             }
-
-            // Confirm password for first wallet (skip if set via env var)
-            const config = getWalletConfig();
-            if (!config.passwordHash && !process.env.NANSEN_WALLET_PASSWORD) {
-              const confirm = await promptPassword('Confirm password: ', deps);
-              if (password !== confirm) {
-                log('❌ Passwords do not match');
+            if (!password && flags.human && (process.stdin.isTTY || deps.promptFn)) {
+              password = await promptPassword('Enter wallet password: ', deps);
+              if (password && password.length < 12) {
+                log('❌ Password must be at least 12 characters');
                 exit(1);
                 return;
               }
+              if (password) {
+                const config = getWalletConfig();
+                if (!config.passwordHash) {
+                  const confirm = await promptPassword('Confirm password: ', deps);
+                  if (password !== confirm) {
+                    log('❌ Passwords do not match');
+                    exit(1);
+                    return;
+                  }
+                }
+              }
+            }
+
+            // Step 3: No password available — return structured error for agents
+            if (!password) {
+              log(JSON.stringify({
+                error: 'PASSWORD_REQUIRED',
+                message: 'A wallet password is required. Ask the user to provide one.',
+                instructions: 'Re-run with: NANSEN_WALLET_PASSWORD=<password> nansen wallet create',
+                note: 'Password must be at least 12 characters. After creation, the password is saved to the OS keychain automatically — future operations will not require it.',
+              }));
+              exit(1);
+              return;
+            }
+
+            if (password.length < 12) {
+              log('❌ Password must be at least 12 characters');
+              exit(1);
+              return;
+            }
+          }
+
+          // Verify password matches existing wallets BEFORE touching keychain
+          if (password !== null) {
+            const config = getWalletConfig();
+            if (config.passwordHash && !verifyPassword(password, config)) {
+              log('❌ Incorrect password — does not match existing wallets.');
+              exit(1);
+              return;
             }
           }
 
+          // Persist password BEFORE creating wallet so we know the storage situation
+          let storageResult = { stored: false, method: 'none' };
+          if (password !== null) {
+            storageResult = storePassword(password);
+          }
+
           try {
             const result = createWallet(name, password);
             log(`\n✓ Wallet "${result.name}" created\n`);
@@ -551,9 +685,24 @@ export function buildWalletCommands(deps = {}) {
             log('');
             if (password === null) {
               log('  ⚠️  This is an UNENCRYPTED hot wallet — private keys are stored in plaintext on disk.');
+            } else if (storageResult.stored && storageResult.method === 'keychain') {
+              log('  ✓ Password saved to system keychain (secure).');
+              log('    Future wallet operations will retrieve the password automatically.');
+            } else if (storageResult.stored && storageResult.method === 'file') {
+              log('  ⚠️  No OS keychain available. Password saved to ~/.nansen/wallets/.credentials (insecure — plaintext on disk).');
+              log('     Future wallet operations will retrieve the password automatically.');
+              log('     To improve security: migrate to OS keychain with `nansen wallet secure`,');
+              log('     or set NANSEN_WALLET_PASSWORD via a secrets manager.');
             } else {
-              log('  ⚠️  This is a hot wallet and is fundamentally insecure — do not deposit more than you can afford to lose.');
-              log('     Store and handle your password securely, e.g. using a secrets manager or system keychain.');
+              log('  ⚠️  CRITICAL: Password could not be saved anywhere (no keychain, no writable filesystem).');
+              log('     You MUST set NANSEN_WALLET_PASSWORD in your environment for ALL future wallet operations.');
+              log('     If you lose this password, your funds are UNRECOVERABLE.');
+            }
+            if (password !== null) {
+              log('');
+              log('  IMPORTANT: Back up your password separately (e.g. password manager).');
+              log('  If you lose access to this machine AND forget the password, funds are unrecoverable.');
+              log('  This is a hot wallet — do not deposit more than you can afford to lose.');
             }
             log('');
             return;
@@ -572,7 +721,8 @@ export function buildWalletCommands(deps = {}) {
           log('');
           for (const w of result.wallets) {
             const star = w.isDefault ? ' ★' : '';
-            log(`  ${w.name}${star}`);
+            const providerTag = w.provider === 'privy' ? ' (privy)' : '';
+            log(`  ${w.name}${star}${providerTag}`);
             log(`    EVM:    ${w.evm}`);
             log(`    Solana: ${w.solana}`);
             log('');
@@ -589,7 +739,8 @@ export function buildWalletCommands(deps = {}) {
           try {
             const result = showWallet(name);
             const star = result.isDefault ? ' ★' : '';
-            log(`\n  ${result.name}${star}`);
+            const providerTag = result.provider === 'privy' ? ' (privy)' : '';
+            log(`\n  ${result.name}${star}${providerTag}`);
             log(`    EVM:    ${result.evm}`);
             log(`    Solana: ${result.solana}`);
             log(`    Created: ${result.createdAt}\n`);
@@ -607,10 +758,14 @@ export function buildWalletCommands(deps = {}) {
             exit(1);
             return;
           }
+
           const config = getWalletConfig();
-          const password = config.passwordHash
-            ? (process.env.NANSEN_WALLET_PASSWORD || await promptPassword('Enter wallet password: ', deps))
-            : null;
+          const { password, error } = await resolvePasswordForCommand(config, flags, deps);
+          if (error) {
+            log(error);
+            exit(1);
+            return;
+          }
           try {
             const result = exportWallet(name, password);
             log(`\n⚠️  Private keys for "${result.name}" — do not share!\n`);
@@ -652,13 +807,33 @@ export function buildWalletCommands(deps = {}) {
             exit(1);
             return;
           }
-          const config = getWalletConfig();
-          const password = config.passwordHash
-            ? (process.env.NANSEN_WALLET_PASSWORD || await promptPassword('Enter wallet password: ', deps))
-            : null;
+
+          // Check if this is a Privy wallet (no password needed)
+          let isPrivy = false;
           try {
-            const result = deleteWallet(name, password);
+            const walletFile = path.join(getWalletsDir(), `${name}.json`);
+            const data = JSON.parse(fs.readFileSync(walletFile, 'utf8'));
+            if (data.provider === 'privy') isPrivy = true;
+          } catch { /* file might not exist, deleteWallet will throw */ }
+
+          let password = null;
+          if (!isPrivy) {
+            const config = getWalletConfig();
+            const resolved = await resolvePasswordForCommand(config, flags, deps);
+            if (resolved.error) {
+              log(resolved.error);
+              exit(1);
+              return;
+            }
+            password = resolved.password;
+          }
+
+          try {
+            const result = await deleteWallet(name, password);
             log(`✓ Wallet "${result.deleted}" deleted`);
+            if (isPrivy) {
+              log(`  Note: server-side wallet still exists on Privy`);
+            }
             if (result.newDefault) {
               log(`  New default: ${result.newDefault}`);
             }
@@ -698,14 +873,32 @@ export function buildWalletCommands(deps = {}) {
           }
 
           const isWalletConnect = options.wallet === 'walletconnect' || options.wallet === 'wc';
+
+          // Check if the wallet is Privy (no password needed)
+          let isPrivyWallet = false;
+          if (!isWalletConnect) {
+            try {
+              const walletName = options.wallet || getWalletConfig().defaultWallet;
+              if (walletName) {
+                const walletFile = path.join(getWalletsDir(), `${walletName}.json`);
+                const data = JSON.parse(fs.readFileSync(walletFile, 'utf8'));
+                if (data.provider === 'privy') isPrivyWallet = true;
+              }
+            } catch { /* ignore */ }
+          }
+
           let password;
-          if (isWalletConnect) {
+          if (isWalletConnect || isPrivyWallet) {
             password = null;
           } else {
             const sendConfig = getWalletConfig();
-            password = sendConfig.passwordHash
-              ? (process.env.NANSEN_WALLET_PASSWORD || await promptPassword('Enter wallet password: ', deps))
-              : null;
+            const resolved = await resolvePasswordForCommand(sendConfig, flags, deps);
+            if (resolved.error) {
+              log(resolved.error);
+              exit(1);
+              return;
+            }
+            password = resolved.password;
           }
           const dryRun = flags['dry-run'] || flags.dryRun;
 
@@ -723,7 +916,6 @@ export function buildWalletCommands(deps = {}) {
             };
 
             if (dryRun) {
-              // Build the transaction but don't broadcast
               const result = await sendTokens(sendOpts);
               log(`\nDry run — transaction not broadcast\n`);
               log(`  From:   ${result.from}`);
@@ -755,46 +947,138 @@ export function buildWalletCommands(deps = {}) {
           }
         },
 
+        'forget-password': async () => {
+          const result = deletePassword();
+          if (result.keychain || result.file) {
+            log('✓ Password removed from:');
+            if (result.keychain) log('  - System keychain');
+            if (result.file) log('  - Credentials file (~/.nansen/wallets/.credentials)');
+          } else {
+            log('No saved password found (keychain or credentials file).');
+          }
+        },
+
+        'secure': async () => {
+          const { password, source } = retrievePassword();
+          if (!password) {
+            log(JSON.stringify({
+              error: 'NO_PASSWORD_FOUND',
+              message: 'No wallet password found in any store.',
+              resolution: [
+                'Set NANSEN_WALLET_PASSWORD and run: nansen wallet secure',
+                'This will store it in the OS keychain.',
+              ],
+            }));
+            exit(1);
+            return;
+          }
+
+          if (source === 'keychain') {
+            log('✓ Password is already stored in the OS keychain (secure).');
+            return;
+          }
+
+          // Verify password actually decrypts wallets before overwriting keychain
+          const walletConfig = getWalletConfig();
+          if (walletConfig.passwordHash && !verifyPassword(password, walletConfig)) {
+            log(JSON.stringify({
+              error: 'INCORRECT_PASSWORD',
+              message: `Password from '${source}' does not match the wallet's stored hash.`,
+              resolution: source === 'file'
+                ? [
+                    'The password in ~/.nansen/wallets/.credentials is incorrect.',
+                    'Run: nansen wallet forget-password  then re-run with the correct password: NANSEN_WALLET_PASSWORD=<pw> nansen wallet secure',
+                  ]
+                : [
+                    'Unset NANSEN_WALLET_PASSWORD if it is stale, then re-run: nansen wallet secure',
+                  ],
+            }));
+            exit(1);
+            return;
+          }
+
+          // Try to migrate to keychain
+          const { stored, method } = storePassword(password);
+          if (stored && method === 'keychain') {
+            const fileRemoved = deleteCredentialsFile();
+            const fromLabel = source === 'file'
+              ? '~/.nansen/wallets/.credentials file'
+              : 'NANSEN_WALLET_PASSWORD env var';
+            log(`✓ Password migrated from ${fromLabel} → OS keychain (secure).`);
+            if (fileRemoved) {
+              log('  Removed ~/.nansen/wallets/.credentials.');
+            }
+          } else {
+            log(JSON.stringify({
+              error: 'KEYCHAIN_UNAVAILABLE',
+              message: source === 'file'
+                ? 'OS keychain is not available. Password remains in ~/.nansen/wallets/.credentials (insecure).'
+                : 'OS keychain is not available. Password is only in the NANSEN_WALLET_PASSWORD env var (not persisted).',
+              resolution: [
+                'Set NANSEN_WALLET_PASSWORD in a secrets manager or system keyring',
+                'Use a containerized secrets agent (e.g. Vault, 1Password CLI)',
+              ],
+            }));
+            exit(1);
+            return;
+          }
+        },
+
         'help': async () => {
           log(`
-Wallet Management - Local key storage for EVM and Solana
+Wallet Management - EVM and Solana wallets (local or Privy server-side)
 
 USAGE:
   nansen wallet <command> [options]
 
 COMMANDS:
-  create [--name <label>] [--unsafe-no-password]
+  create [--name <label>] [--provider <local|privy>] [--unsafe-no-password]
                              Create a new wallet pair (EVM + Solana)
   list                       List all wallets
   show <name>                Show wallet addresses
-  export <name>              Export private keys (requires password)
+  export <name>              Export private keys (local wallets only, requires password)
   default <name>             Set the default wallet
-  delete <name>              Delete a wallet (requires password)
+  delete <name>              Delete a wallet
   send --to <address> --amount <number> --chain <evm|solana> [--token <address>] [--wallet <name>] [--max] [--dry-run]
                              Send tokens or native currency (--max sends entire balance, --dry-run previews without sending)
+  forget-password            Remove saved password from all stores
+  secure                     Migrate password from insecure storage to OS keychain
 
 OPTIONS:
   --name <label>             Wallet name (default: "default")
+  --provider <local|privy>   Wallet provider: "local" (default) stores encrypted keys on disk,
+                             "privy" creates server-side wallets via Privy API
   --to <address>             Recipient address (required for send)
   --amount <number>          Amount to send in human-readable format (required unless --max)
   --chain <evm|solana>       Blockchain to use (required for send)
   --token <address>          Token contract/mint address (optional, sends native if omitted)
   --wallet <name>            Wallet to use (optional, uses default if omitted; use "walletconnect" or "wc" for WalletConnect, EVM only)
   --max                      Send entire balance (deducts gas for native transfers)
-  --unsafe-no-password       Skip encryption — private keys stored UNENCRYPTED on disk (create only)
+  --unsafe-no-password       Skip encryption — private keys stored UNENCRYPTED on disk (local only)
+  --human                    Enable interactive prompts (for human terminal use only)
+
+PASSWORD RESOLUTION (automatic, in order):
+  1. NANSEN_WALLET_PASSWORD env var
+  2. OS keychain (saved automatically on wallet create)
+  3. Interactive prompt (only with --human flag)
 
 ENVIRONMENT:
-  NANSEN_WALLET_PASSWORD     Password for non-interactive use (e.g. CI/scripts)
+  NANSEN_WALLET_PASSWORD     Wallet encryption password
+  PRIVY_APP_ID               Privy application ID (required for --provider privy)
+  PRIVY_APP_SECRET           Privy application secret (required for --provider privy)
+  NANSEN_WALLET_PROVIDER     Default provider for wallet create ("local" or "privy")
   NANSEN_EVM_RPC            Custom EVM RPC endpoint
   NANSEN_SOLANA_RPC         Custom Solana RPC endpoint
 
 EXAMPLES:
-  nansen wallet create --name trading
+  NANSEN_WALLET_PASSWORD=mypass nansen wallet create --name trading
+  nansen wallet create --name agent-wallet --provider privy
   nansen wallet list
   nansen wallet export trading
   nansen wallet default trading
   nansen wallet send --to 0x742d35Cc... --amount 1.5 --chain evm
   nansen wallet send --to 9WzDXw... --amount 0.1 --chain solana --token So11...
+  nansen wallet forget-password
 `);
           return;
         },